DNSHarness Duane Wessels DNS-OARC Workshop, Dublin May 12, 2013.

DNSHarness

Duane WesselsDNS-OARC Workshop, DublinMay 12, 2013

2

Have You Ever Wanted To…

3

• A testing harness for name server products.• Primarily designed for functional, rather than

performance, testing.• Scriptable.• Open Source.• Written by Paul Hoffman for Verisign.

DNSHarness Is …

4

• Ubuntu on the “bare metal”• VirtualBox for virtualization• Debian for virtual servers• Lots of Python scripting• JSON to describe Projects

Underlying Technologies

5

The Bits and Pieces

l

Host OS (Ubuntu)

projectscripts

and files

closed source

products

NAT VMs(optional)

open sourceVMs

externalservers

closed source

productsclosed source

products

nat2

clone3

clone2

clone1

opensource

nat1

6

• Start with decent system that can support a handful of virtual servers.

• Make sure processor has “virtualization technology”• Intel VT-x• AMD-v

• Tested at Verisign with• 8 cores of Xeon 2 GHz• 8 GB RAM• 1 TB HDD• 1 NIC

Hardware

7

• Installation instructions based on [X]Ubunutu 12.04• Might work on similar flavors, but not tested

Operating System

8

• See “Downloads” on http://www.dnsharness.org/• Open doc/Installation.html in browser for easy cut-and-

pasting of commands• First steps are to install VirtualBox, OpenSSH Server,

and Python on Ubuntu.• Note in “download debian.iso” step the referenced

debian-6.0.3-i386-netinst.iso is no longer on most mirror sites. A copy is saved at http://www.dnsharness.org/third-party/debian-6.0.3-i386-netinst.iso

Download DNSHarness

9

• The “getsources” step of installation downloads source tarballs for known open source name server implementations:• BIND (8, 9, 10)• Unbound• PowerDNS• NSD• KnotDNS• dnsmasq

• Approx 2.5 GB download• Took me about 3 hours

“getsources”

10

• DNSHarness attempts to compile all downloaded open source implementations

• Took 11 hours on my system – plan accordingly!

“build all”

11

• DNSHarness can test closed-source implementations• Referenced by server IP address• User may be able to script start, stop, flush, etc

operations if desired.

Closed-Source Implementations

12

A Sample DNSHarness Project: VERSION.BIND

13

• projectdesc.json• RunOnOpenSource• RunOnHost• Server Configurations• Ancillary Files

• example.com zone• root hints

Files We’ll Need

14

{ "name" : "version.bind", "comment1" : "Send a VERSION.BIND query to every implementation", "targets" : [ { "opensource" : [ "dnsmasq-1\\..*", "dnsmasq-2\\.1[1-9]", "dnsmasq-2\\.[2-9][0-9]", "bind-8.*", "bind-9.*", "unbound-.*", "knot-.*", "nsd-.*", "pdns-.*" ] } ]}

projectdesc.json

15

• Python script• Starts and stops open source servers• Executes “pre-commands” if necessary

• e.g., NSD and Knot use compiled zones

• Tries to capture startup errors• But not those that go to syslog

• http://www.dnsharness.org/examples/version.bind/RunOnOpenSource

RunOnOpenSource

16

• Runs on the Ubuntu system (not a VM)• Called at various times

• Start of project• Start of each target• To do the actual test• End of each target• End of project

• For VERSION.BIND test, calls ‘dig’ and parses its output

• http://www.dnsharness.org/examples/version.bind/RunOnHost

RunOnHost

17

$ wget http://www.dnsharness.org/examples/version.bind.tgz$ tar xzvf version.bind.tgz$ DNSharnessRun.py project `pwd`/version.bindRunning project version.bindStarting time: 2013-05-09-11-23-26'dnsmasq-1\..*' expanded to 14 distributions....'pdns-.*' expanded to 30 distributions.Total distributions: 374Starting dnsmasq-1.10Starting dnsmasq-1.11...Starting pdns-3.2Elapsed run time for project: 1133 seconds

$ less version.bind/Output/*

• Debugging log file at $HOME/.dnsharness/log/debuglog.txt

Running the Test

18

Software Result

BIND-8.* “8.x.x-REL”

BIND-9.* “9.x….”

dnsmasq-1.2 timeout

dnsmasq-1.6 – 1.17 upstream’s version.bind

dnsmasq-1.18 -- “dnsmasq-x.yy”

knot-* Warning: Message parser reports malformed message packet.

NSD-* “NSD x.y.z”

Results

19

Software Result

pdns-2.9.1 – 2.9.19 Warning: Message parser reports malformed message packet.

pdns-2.9.22.* Question section mismatch: got version.bind/TXT/IN

pdns-3.* “Served by POWERDNS 3.x $Id: packethandler.cc nnnn yyyy-mm-dd”

unbound-0.4 – 0.5 “unbound 0.x”

unbound-0.6 – 1.0.2 timeout

unbound-1.1.0 -- “unbound 1.x.y”

20

• Downloads, Documentation, and Examples:• http://www.dnsharness.org

• User’s mailing list:• https://lists.verisignlabs.com/mailman/listinfo/dnsharness-users

Participate!

Thank You

© 2013 VeriSign, Inc. All rights reserved. VERISIGN and other trademarks, service marks, and designs are registered or unregistered trademarks of VeriSign, Inc. and its subsidiaries in the United States and in foreign countries. All other trademarks are property of their respective owners.